Nonrepudiation

Nonrepudiation is a security concept that ensures that a person or entity cannot deny having performed a claimed action or having sent or received a particular message. It provides evidence of origin, integrity, and delivery, supporting accountability in electronic transactions. Nonrepudiation covers two main aspects: nonrepudiation of origin, which prevents a sender from denying authorship, and nonrepudiation of receipt, which prevents a recipient from denying receipt.

Key components include digital signatures, which bind a message to a signer; cryptographic hashes; public key infrastructure; time stamps; secure logs; tamper-evident audit trails; and trusted third parties that issue and manage credentials. In practice, nonrepudiation relies on evidence such as signed data, verified signatures, and trusted time stamps.

Common applications include email signing (S/MIME, PGP), document signing, blockchain transactions, and electronic contracts. Policies and standards govern what constitutes acceptable nonrepudiation evidence and how long it must be retained; evaluation may involve legal admissibility and cross-border recognition.

Challenges include key management and protection, certificate revocation, reliance on trusted authorities, algorithm retirement, privacy concerns, and potential disputes about evidence sufficiency. Nonrepudiation does not guarantee truth, only that credible evidence exists; it must be supported by robust controls, audits, and lawful retention.